Question 1

On a dual-redundant DP control system, DP Computer 1 (the currently active controller) throws an internal software fault and freezes. What should happen automatically, and what must the DPO verify?

Accepted Answer

The system should automatically switch over to DP Computer 2 (the standby/redundant controller) seamlessly, with thrusters continuing under DP2's control without interruption; the DPO must verify the changeover actually occurred cleanly, that DP2 has correct position and reference data, and that no thruster commands were lost or duplicated during the transition A control system fault is exactly the scenario the redundant computer architecture exists for. The DPO's job is not to cause the changeover (it should be automatic) but to verify it happened correctly and completely — control system failures are subtle precisely because the changeover can appear successful while data is actually inconsistent.

Question 2

Generators are running normally and all position reference systems show valid, agreeing positions, yet the vessel still experienced a brief uncommanded thrust transient during the changeover. What category of failure does this indicate, and why does it matter that the DPO correctly identifies it as such?

Accepted Answer

This is a control-system/software failure category, distinct from power generation or sensor failures — correctly identifying the category matters because the troubleshooting, the people who need to be involved (DP system OEM/software support, not just the electrical engineer), and the appropriate caution around trusting the "recovered" system are all different from a power or sensor event Control system/software failures are a genuinely distinct failure category from power and sensor failures — the FMEA treats them differently, the right specialist to call is different, and critically, a software fault can recur unpredictably in ways a hardware power fault usually does not. Misclassifying the failure type leads to the wrong response and the wrong people being engaged.

Question 3

Shortly after the changeover, a UPS (Uninterruptible Power Supply) low-battery alarm activates for the UPS feeding the DP control network. What is the significance of this, given that the DP computers themselves appear to be running normally?

Accepted Answer

The UPS is what keeps the DP control system powered through any brief interruption or transient in the ship's main electrical supply — a degraded UPS battery means the DP control system itself (not just the thrusters) could lose power during even a momentary electrical disturbance, which would be a far more serious event than the computer fault just experienced This is the kind of finding that should escalate concern, not be dismissed because "the computers seem fine now." A degraded UPS is a latent failure waiting for the trigger event (a power transient) that would turn a manageable software fault into total loss of DP control — exactly the kind of hidden, compounding risk a vigilant DPO should flag.

DP — Control System Failure (Cascade) Practice Questions